Automated SSL certificate renewal for Citrix NetScaler

NetScaler won't update a renewed certificate on its own. CertKit will.

When a certificate renews, the files under /nsconfig/ssl go stale and every binding keeps serving the old certificate until someone uploads the new files, updates the certkey, and saves the configuration. Every 47 days. On every appliance you manage.

CertKit centralizes certificate issuance and renewal, then pushes the renewed certificate to your NetScaler appliances (Citrix ADC) automatically via the CertKit Agent over SSH, refreshes the certkey pair in place, and saves the config.

Start free trial Watch demo

Built for Citrix NetScaler

Pre-built templates for standalone appliances, HA pairs, and clusters ship in your CertKit account. No scripting required.

CertKit renews your NetScaler certificate for you. On every renewal it uploads the new certificate, private key, and intermediate chain over SCP, runs update ssl certkey so the pair refreshes in place, wires the chain links, and saves the running configuration. Every SSL-offload virtual server, service, and Citrix Gateway bound to that certkey serves the new certificate immediately. No per-vserver rebinding, no service restart.

Three pre-built NetScaler templates ship with your CertKit account — one each for a standalone appliance, an HA pair, and a cluster. Point CertKit at your appliance once and it handles every renewal after that. If you want to see or adjust exactly what runs, the full deployment script is right there in your account.

How to install an SSL certificate on Citrix NetScaler

The manual process, if you want to do it yourself:

Create a certificate request. Under Traffic Management → SSL, create a Certificate Signing Request on the appliance, or create the CSR and key externally. A wildcard certificate covers Gateway and every virtual server on the domain with one certkey.
Submit the CSR to a certificate authority. Purchase a certificate or use a free ACME CA, then wait for the signed certificate file to come back.
Upload the certificate and key. Under Traffic Management → SSL → Certificates, choose Install, or copy the PEM and key to /nsconfig/ssl over SCP. Point at the wrong path and the install fails with "cannot find file or folder".
Update the certkey pair. Select the existing certificate-key pair and choose Update, so every LB vserver, service, and Citrix Gateway binding refreshes at once. A brand-new certkey has to be bound to each SSL vserver by hand instead. If the subject changed, the update fails a domain check you have to override.
Save the running configuration. Run save ns config, or the renewal disappears on the next reboot. Then repeat on every appliance that doesn't share HA config.

Every one of these steps is manual, and NetScaler won't repeat any of them for you when the certificate renews. With lifetimes shrinking to 47 days, installation stops being an annual chore and becomes a recurring task: twelve times a year, on every MPX, VPX, and SDX you run. Miss one and Citrix Gateway greets remote workers with an expired certificate.

At 47 days, automation is the only sustainable way to run NetScaler certificates. Here's how CertKit does it.

How it works

 Your network            CertKit                 ACME CA
┌───────────────────┐     ┌──────────────────┐    ┌─────────────┐
│  ┌─────────────┐  │     │                  │    │             │
│  │Deploy Agent │◄─┼─────┤  Issue & Renew   │◄──►│             │
│  └──┬────┬─────┘  │     │   Certificates   │    │             │
│     │    │ SSH/   │     │                ┌───┐  └─────────────┘
│     │    │ SCP    │     └───────────┬────│DNS│
│     ▼    ▼        │                 │    └───┘
│ ┌──────────────┐  │                 │
│ │ NetScaler    │  │                 │
│ │ [x] Uploaded │  │ ◄───────────────┘
│ │ [x] Updated  │  │       Verify
│ └──────────────┘  │
└───────────────────┘

CertKit issues and renews certificates centrally in the cloud using delegated DNS validation. You create a one-time CNAME record; CertKit handles every ACME challenge after that.

The deploy agent is a small service you run on a Windows host inside your network. It makes an outbound HTTPS connection to CertKit to pull each renewed certificate, then connects to the NetScaler management address — the NSIP, or the cluster IP for a cluster — over SSH on your LAN to upload the files and refresh the certkey pair. The appliance never talks to CertKit or the public internet directly, never runs ACME, needs no port 80 open, and never stores DNS credentials. One deploy agent can reach every NetScaler and other appliance on that network, so there's nothing to install on the appliances themselves.

From an operational perspective, CertKit is easy to deploy and manage. The ability to configure unique and specialized certificates is key to replacing our manual certificate processes.

Laura Thomas, Senior Central Systems Administrator, University of St. Thomas

Three NetScaler topologies, three templates

A certificate renewal has to land differently on a standalone appliance, an HA pair, and a cluster — files that exist on only one node are a certificate outage waiting for a failover. CertKit ships a separate template for each topology, so the deployment matches how your NetScalers are actually built.

Single host SSH to the NSIP, certkey update in place HA pair (active/passive) Deploys via the primary, syncs SSL files to the secondary Cluster (active/active) Deploys through the CLIP, propagated to every node

The HA pair template can point at either node. It reads the HA state and deploys through whichever node is currently primary, refuses to run if either node is down or command propagation is disabled, and runs sync HA files ssl so the uploaded files reach the secondary before any certkey command that depends on them. Certkey commands and the config save propagate to the secondary, so both nodes serve the new certificate — including after a failover.

The cluster template connects through the cluster management IP (CLIP), where the configuration coordinator propagates every command to every node. It runs sync cluster files ssl after the uploads so the files exist cluster-wide before the certkey refresh, and verifies cluster health before and after the update.

Three NetScaler topologies, three templates

What CertKit handles

Issue certificates via ACME, centrally. Your appliances have no ACME configuration, no open ports, no public DNS credentials. One CNAME record is all your domain contributes.
Renew automatically before expiry. That one-time CNAME covers every renewal challenge going forward. No intervention required on any device.
Upload the PEM, key, and chain over SCP. The CertKit Agent copies the renewed certificate, private key, and each intermediate in the chain to /nsconfig/ssl, next to the appliance's existing SSL files.
Refresh the certkey pair in place. The agent runs update ssl certkey over SSH, so every virtual server, service, and Citrix Gateway bound to the pair serves the new certificate the moment the update lands. No per-vserver rebinding, no restart, no dropped sessions. The update passes -noDomainCheck, so a renewal whose subject changed — or a short-lived certificate with no Common Name at all — doesn't fail NetScaler's domain-match check.
Install and link the intermediate chain. A certkey only loads the first certificate in its file, so the served chain comes from certkey links, not file contents. CertKit installs each intermediate under a shared content-addressed certkit-i- name — reusing it if it's already installed under another name — and wires the links leaf → intermediate → intermediate. Routine renewals leave the links untouched; they're rewired only when the chain itself changed.
Keep every node in sync. The HA pair and cluster templates make sure the files and the certkey update land on every node, not just the one the agent connected to, so a failover never resurrects the old certificate.
Authenticate with an SSH key, not a password. The agent uses key-based SSH through the built-in OpenSSH client and locks the key file's permissions to itself before each connection. Use a key dedicated to CertKit.
Save the running configuration. After the certkey refreshes, the agent runs save ns config so the renewal survives a reboot.
Verify the deployment, not just the script. After each renewal, CertKit connects to your published virtual server and confirms the new certificate is actually being served. It checks the serial number, SANs, and expiry. If something is wrong, you find out before your users do.
Alert on failure. Upload failures, certkey update errors, verification mismatches, and upcoming expirations all generate alerts before they become incidents.
Audit every change. Every issuance, renewal, and deployment is logged with timestamp, certificate, and device. With certificate lifetimes heading to 47 days, that log is your compliance record.

Setup takes about ten minutes

Connect your domain. Add a one-time CNAME record to delegate DNS validation to CertKit. Every renewal challenge after that is automatic.
Authorize an SSH key. Generate a key pair with ssh-keygen and add the public key to the NetScaler user's authorized keys (/nsconfig/ssh/authorized_keys for nsroot). A dedicated automation account is better practice than nsroot.
Install the CertKit Agent. One command on any Windows host with SSH reachability to the NSIP. The agent runs as a background service and needs no inbound firewall rules.
Add the NetScaler deployment script. Pick the template for your topology — single host, HA pair, or cluster. Set the NSIP (or cluster IP), SSH user, key path, and the certkey name from Traffic Management → SSL → Certificates. CertKit runs it on every renewal.

See the full architecture →

NetScaler deployment requirements and troubleshooting →

Why not run ACME on the NetScaler?

Answering ACME challenges from the appliance itself is fragile. HTTP-01 means maintaining responder policies for the challenge path on every domain's virtual server. DNS-01 means storing DNS provider credentials on the device that terminates TLS for your applications, which is a privilege escalation waiting to happen.

Scripting the renewal yourself has its own sharp edges: SSH automation against the NSIP, the domain check that rejects an update when the subject changed, keeping /nsconfig/ssl in sync across HA nodes, and the save ns config everyone forgets until a reboot rolls the certificate back. We built and tested the deployment so you don't have to. CertKit issues the certificate via delegated DNS validation, then the agent handles the upload, the certkey update, and the save as one verified step, with no ACME client on the appliance.

NetScaler is just one part of your network edge

Most networks have more than one place where TLS certificates live: other load balancers like F5 BIG-IP and Kemp LoadMaster, firewalls like Fortinet, Palo Alto, SonicWall, Cisco Firepower, and Juniper SRX, plus the web servers behind them. CertKit automates all of it from one account.

See all integrations

Start automating NetScaler certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing